The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data was opened for signature on 28 January 1981 and is still today the only binding international treaty in this field. It is open to any country, and has the potential to become a global standard. The 47 member states of the Council of Europe and Mauritius, Senegal, Tunisia, Uruguay are Parties to it, while Argentina, Burkina Faso, Cap Verde, Mexico and Morocco have been invited to accede to the Convention.

The treaty establishes a number of principles for states to transpose into their domestic legislation to ensure notably that data are processed through procedures set for by law, for a specific purpose, that data are stored for no longer than is necessary for the intended purpose, and that are not excessive in relation to the purposes for which they are stored.

An additional protocol requires each party to establish an independent authority to ensure compliance with data protection principles, and lays down rules on transborder data flows to non Parties.